CVE-2026-50165: alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-09 · updated 2026-09-10
Weakness: CWE-284

Description

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuration" endpoints. The affected endpoints require organization or event ownership, but they accept an arbitrary configuration key and then return the first matching value from a lookup that includes system-level configuration. As a result, an organization owner can retrieve secrets intended to be administrator-only, including the system API key when it is configured. Version 2.0-M5-2605 fixes the issue.

Affected products

alfio-event alf.io: before 2.0-M5-2606

References

https://github.com/alfio-event/alf.io/security/advisories/GHSA-x473-r8w6-fcq5

Get alerted when CVE-2026-50165 or the next vulnerability affects your stack